PayPal invoice scam: the fake charge with a phone number
Scammers send invoices for things like antivirus renewals, sometimes through real payment systems, and put their own phone number in the note. They hope you call to "cancel" so they can talk you into paying or handing over access.
How this scam works
An invoice is only a request, so nothing has been charged yet. The scam starts when you call the number and the "support agent" asks for logins, codes, or remote access, or pushes you to send money for a fake refund.
Common versions of the message
- An antivirus or software renewal you did not buy
- A phone number to call to cancel
- A 24-hour deadline before you are charged
What the message looks like
Email from service@paypal-billing.top: Invoice #PP-77310: payment due
You have received an invoice for $599.00 for Norton Total Security, auto-renewed today. If you did not make this purchase, call PayPal Billing Support at (555) 016-4471 within 24 hours to cancel and receive a refund.
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Surprise invoice: “invoice for $599.00”
Made to scare you into calling
An invoice you did not expect is a request, not a charge. Log in to your account by typing the address yourself and check your activity.
- 2
Number in the invoice: “call PayPal Billing Support at (555) 016-4471”
Scammers put their own number in real PayPal invoices
The phone number inside the invoice belongs to the scammer. Use the help page on the company's real website instead.
- 3
Rushed deadline: “within 24 hours”
So you call before you check your real account
The short deadline is there so you call before you look at your real account.
What to do
- Do not pay the invoice and do not call the number in it.
- Log in to PayPal by typing paypal.com yourself and check whether anything was charged.
- Report the invoice inside your PayPal account and delete the email.
If you already replied, clicked, or paid
- If you called and gave a password or code, change your password and turn on two-step verification.
- If you paid the invoice, report it in your PayPal account right away and call your bank or card issuer.
- If you allowed remote access, disconnect from the internet and get the device checked.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.